Add WalletKit browser WASM package POC

.github/workflows/ci.yml

@@ -29,7 +29,9 @@ jobs:
 
       - uses: worldcoin/bedrock/.github/actions/version-alignment@857c252013ac52cea24f5d7add3475a909d663f2 # main
         with:
-          uniffi_version: ${{ vars.UNIFFI_VERSION }}
+          # Match the temporary generator compatibility pin in Cargo.toml.
+          # Restore vars.UNIFFI_VERSION when the web generator supports 0.32.
+          uniffi_version: "0.31.2"
           rust_toolchain_channel: ${{ vars.RUST_TOOLCHAIN_CHANNEL }}
 
   lint:

Cargo.toml

@@ -75,7 +75,9 @@ tokio-test = "0.4"
 tracing = "0.1"
 tracing-log = "0.2"
 tracing-subscriber = "0.3"
-uniffi = { version = "0.32.0", features = [
+# uniffi-bindgen-react-native 0.31.0-5 cannot parse UniFFI 0.32 metadata yet.
+# Remove this pin once https://github.com/jhugman/uniffi-bindgen-react-native/pull/409 lands.
+uniffi = { version = "0.31.2", features = [
   "tokio",
   "wasm-unstable-single-threaded",
 ] }

README.md

@@ -51,6 +51,21 @@ binding tests with `cargo xtask swift test`.
 
 See [`swift/README.md`](swift/README.md) for package integration details.
 
+## Local development (browser/WASM)
+
+The experimental `walletkit-web` package builds directly from the
+`walletkit` crate and contains the generated bindings, wasm-bindgen glue, and
+optimized WASM module. Build it with the pinned WASM toolchain:
+
+```bash
+nix develop .#wasm --command bun install --cwd web/walletkit --frozen-lockfile
+nix develop .#wasm --command bun run --cwd web/walletkit build
+```
+
+The Next.js integration probe under `examples/uniffi-web-authenticator-poc`
+installs the published package and consumes its public `initializeWalletKit()`
+interface.
+
 ## Local development (Android/Kotlin)
 
 ### Prerequisites

crates/walletkit-core/Cargo.toml

@@ -116,6 +116,10 @@ compress-zkeys = [
 
 issuers = []
 
+# Exports authenticator futures without UniFFI's Tokio compatibility adapter.
+# Browser WASM has no thread on which async-compat can host its fallback runtime.
+uniffi-wasm = []
+
 # Embeds compiled zkeys into the binary at compile time for `EmbeddedZkArtifacts`.
 # On native targets, `CachingZkArtifacts` can cache the embedded material on disk.
 # Disable this feature for environments where binary size matters (e.g. WASM).

crates/walletkit-core/src/authenticator/mod.rs

@@ -100,7 +100,8 @@ fn parse_authenticator_pubkey(
     Ok(pubkey)
 }
 
-#[uniffi::export(async_runtime = "tokio")]
+#[cfg_attr(feature = "uniffi-wasm", uniffi::export)]
+#[cfg_attr(not(feature = "uniffi-wasm"), uniffi::export(async_runtime = "tokio"))]
 impl Authenticator {
     /// Returns the packed account data for the holder's World ID.
     ///
@@ -494,7 +495,8 @@ impl Authenticator {
     }
 }
 
-#[uniffi::export(async_runtime = "tokio")]
+#[cfg_attr(feature = "uniffi-wasm", uniffi::export)]
+#[cfg_attr(not(feature = "uniffi-wasm"), uniffi::export(async_runtime = "tokio"))]
 impl Authenticator {
     /// Initializes a new Authenticator from a seed and with SDK defaults.
     ///
@@ -842,7 +844,8 @@ impl From<GatewayRequestState> for RegistrationStatus {
 #[derive(uniffi::Object)]
 pub struct InitializingAuthenticator(CoreInitializingAuthenticator);
 
-#[uniffi::export(async_runtime = "tokio")]
+#[cfg_attr(feature = "uniffi-wasm", uniffi::export)]
+#[cfg_attr(not(feature = "uniffi-wasm"), uniffi::export(async_runtime = "tokio"))]
 impl InitializingAuthenticator {
     /// Registers a new World ID with SDK defaults.
     ///

crates/walletkit-core/src/credential.rs

@@ -125,7 +125,6 @@ impl Deref for Credential {
         &self.0
     }
 }
-
 #[cfg(test)]
 mod tests {
     use ruint::aliases::U256;

crates/walletkit-core/src/storage/credential_storage.rs

@@ -346,6 +346,26 @@ impl CredentialStore {
     }
 }
 
+#[cfg(all(target_arch = "wasm32", feature = "uniffi-wasm"))]
+#[uniffi::export]
+impl CredentialStore {
+    /// Creates process-local credential storage for browser demos and tests.
+    ///
+    /// The store is discarded when the page is refreshed. Its key envelope is
+    /// kept in memory without device-bound encryption, so callers must not use
+    /// this constructor for production credentials.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the in-memory storage handle cannot be created.
+    #[uniffi::constructor]
+    pub fn new_ephemeral() -> StorageResult<Self> {
+        Self::from_provider_arc(Arc::new(
+            super::ephemeral::EphemeralStorageProvider::new(),
+        ))
+    }
+}
+
 #[uniffi::export]
 impl CredentialStore {
     /// Permanently destroys all credential storage data.